Executive brief
Actual, a personal finance and budgeting application, contained a flaw where users who were disabled by an administrator could still access their accounts. While the system blocked new logins for disabled accounts, it failed to invalidate existing active sessions. This means a deactivated user—including a former administrator—could continue to view sensitive financial data or modify budgets indefinitely if they had an active session token.
Technical details
A session management vulnerability exists in Actual Budget's sync-server prior to version 26.6.0. While the OpenID login flow correctly checks the 'enabled' status of a user, the 'validateSession' middleware only verified that a session token existed and had not expired. Because the default 'token_expiration' is set to 'never', disabled users could retain access indefinitely. An attacker with a pre-existing session token can continue to call authenticated endpoints, including sync operations and administrative functions if they previously held an admin role. The fix in 26.6.0 ensures the session validation path joins with the users table to verify the account is still enabled and revokes existing sessions upon user deactivation.
Affected products
- actualbudget Actual Budget < 26.6.0
Timeline
- 2026-06-01: patched: Version 26.6.0 released
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD